tldr; 1. Attacker found a stackoverflow dev environment requiring a login/password and access key to get in. 2. Attacker was able to login to the dev environ

tldr; 1. Attacker found a stackoverflow dev environment requiring a login/password and access key to get in. 2. Attacker was able to login to the dev environment with their credentials from prod (stackoverflow.com) by a replay attack based on logging in to prod. 3. The dev environments allows viewing outgoing emails, including password reset magic links. The attacker triggered a reset password on a dev account, and changed the credentials. This gives them access to "site settings." 4. Settings listed TeamCity credentials. The attacker logged into TeamCity. 5. Attacker spends a day or so getting up to speed with TeamCity, in part by reading StackOverflow questions. 6. Attacker browses the build server file system, which includes a plaintext SSH key for GitHub. 7. Attacker clones all the repos 8. Attacker alters build system to execute an SQL migration that escalates him to a super-moderator on production (Saturday May 11th). 9. Community members make security report on Sunday May 12th, stackoverflow response found the TeamCity account was compromised and moved it offline. 10. Stackoverflow determines the full extent of the attack over the next few days.